SAM·AI is federal contracting intelligence for small business. This policy explains what data we collect when you use SAM·AI, how we use and protect it, and the rights you hold over it. It pays particular attention to two things that make SAM·AI different: the federal-capture data you entrust to us, and our scoped Google Drive model, under which your documents stay in your own Drive rather than in a copy held by us.
Data Controller
DSM.Promo is the entity behind SAM·AI and acts as the data controller responsible for your personal information. SAM·AI is a DSM.Promo product. For any privacy matter, including the exercise of your data rights, contact us at [email protected].
Where SAM·AI processes information on your behalf to deliver the service, such as the federal-capture material you supply, we act as a processor under your instructions and you remain the controller of that content.
What We Collect
We collect only the data needed to run SAM·AI and to support your federal-capture work:
- Account information — your name, email address, and company name, provided when you register or are invited to a workspace.
- Federal-capture data you provide — the inputs that power the platform: your NAICS codes, capability statements, past performance, certifications, and the opportunities you choose to pursue. This is content you submit deliberately so SAM·AI can score fit and draft proposals.
- Usage and analytics data — pages visited, features used, session timing, browser and device type. This is used to operate and improve the service and is handled in an aggregate, non-identifying form wherever possible.
- Billing information — subscription and payment data. Payments are processed by Stripe; we do not store your card numbers on our systems.
- Visitor and lead data from the public chat — if you contact us through the chat widget or a contact form, we collect the name, email, and message content you provide so we can respond.
The Google Drive Model
Your opportunities and the documents SAM·AI generates — capability statements, proposal drafts, capture plans — live in your own Google Drive, under your account and your control, not in a separate store we own.
SAM·AI connects using scoped OAuth. We request the drive.file scope, which is least privilege by design: it grants access only to the specific files SAM·AI itself creates or that you explicitly open with SAM·AI. We cannot see, list, or touch the rest of your Drive.
When the platform needs a document to score an opportunity or draft a proposal, it streams that content on demand and discards it after the operation completes. We store only references and an index — file identifiers and metadata needed to find your documents again — never a separate copy of your files.
The practical effect is that you own and govern your federal-capture documents directly in Google Drive. Revoking SAM·AI's access in your Google account immediately cuts off our ability to read those files.
No Model Training On Your Data
We do not train AI models on your documents or your federal-capture data. Your capability statements, proposals, opportunity selections, and the content streamed from your Drive are used solely to deliver the service to you. They are not added to training sets, used to improve a shared model, or shared with model providers for training purposes.
How We Use Your Data
We use the information described above to:
- Provide and operate the SAM·AI service and your workspace.
- Score opportunity fit and generate proposals, capability statements, and capture plans from the inputs you supply.
- Respond to your questions and provide support.
- Process billing and manage your subscription.
- Improve the product, using aggregate and non-identifying analytics.
We process your data on the lawful bases of contractual necessity (to deliver the service you signed up for), your consent (for example, when you connect Google Drive), and our legitimate interest in operating and improving SAM·AI.
We Do Not Sell Your Data
We will never sell, rent, or trade your personal information or your federal-capture data to third parties for their own purposes. This applies under both GDPR and CCPA/CPRA. Your data is used to serve you, not to be monetized.
Third-Party Processors
We rely on a small set of vetted service providers to operate SAM·AI. Each processes data only as needed to deliver its function, under terms that meet our security and privacy standards:
| Processor | Purpose |
|---|---|
| Drive storage for your documents (scoped drive.file), Calendar integration, and OAuth sign-in / authentication. | |
| Stripe | Payment and subscription processing. Card data is handled by Stripe; we do not store card numbers. |
| Cloudflare | Content delivery, DNS, DDoS protection, and web application security. |
| Hosting provider | Secure cloud infrastructure on which the SAM·AI application and its index run. |
We do not transfer your personal data to any other third parties except where required by law.
Cookies and Analytics
We use essential cookies needed for sign-in, security, and session management, together with privacy-respecting analytics to understand how the service is used. We do not use advertising or cross-site tracking cookies.
Where required, we ask for your consent before placing non-essential cookies through a consent banner, and you can change your choices at any time.
Data Security
We protect your information with layered controls:
- Encryption in transit (TLS) and at rest for the data we hold.
- Strict access controls, with personal and capture data limited to authorized personnel on a need-to-know basis.
- A Zero Trust architecture, with continuous verification, network segmentation, and least-privilege access.
- Security monitoring, incident response procedures, and regular review.
For more detail on our security posture, see our Security page.
Data Retention
We retain your account and capture data for as long as your account is active and for a reasonable period afterward to meet legal, accounting, and operational obligations. Because your documents live in your own Google Drive, they remain under your control regardless of our retention of the index. You can request deletion of your personal data and account at any time, and we will action it within a reasonable period.
Your Rights
Depending on where you live, you have rights over your personal data under GDPR and CCPA/CPRA, including:
- Access — a copy of the data we hold about you.
- Correction — fixing inaccurate or incomplete information.
- Deletion — erasure of your personal data.
- Portability — receiving your data in a machine-readable format.
- Opt-out — objecting to certain processing; California residents may opt out of any sale or sharing of personal information (we do not sell data).
To exercise any of these rights, email [email protected]. We respond to verified requests within the timeframes required by applicable law.
Breach Notification
In the unlikely event of a data breach that affects your personal information, we will notify affected users and the relevant authorities without undue delay, and in any case within the timeframes required by GDPR and applicable state and federal law.
Children's Privacy
SAM·AI is a business tool for federal contractors and is not intended for individuals under 18 and is not directed to children. We do not knowingly collect personal data from minors. If we learn that we have collected data from a child, we will delete it promptly.
Changes to This Policy
We may update this policy as SAM·AI evolves or as regulations change. When we make material changes, we will update the date above and, where appropriate, notify you by email or in the product. Continued use of SAM·AI after an update takes effect means you accept the revised policy.
Contact Us
If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at [email protected]. SAM·AI is a product of DSM.Promo.